Skip to content
Projects
Groups
Snippets
Help
This project
Loading...
Sign in / Register
Toggle navigation
K
k3s
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Registry
Registry
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Jacklull
k3s
Commits
7cc01100
Commit
7cc01100
authored
Nov 28, 2019
by
yuzhiquan
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
fix typo
parent
00e8a29b
Hide whitespace changes
Inline
Side-by-side
Showing
2 changed files
with
13 additions
and
13 deletions
+13
-13
containerd.go
pkg/agent/containerd/containerd.go
+2
-2
network_policy_controller.go
pkg/agent/netpol/network_policy_controller.go
+11
-11
No files found.
pkg/agent/containerd/containerd.go
View file @
7cc01100
...
...
@@ -76,13 +76,13 @@ func Run(ctx context.Context, cfg *config.Node) error {
}()
for
{
addr
,
d
ai
ler
,
err
:=
util
.
GetAddressAndDialer
(
"unix://"
+
cfg
.
Containerd
.
Address
)
addr
,
d
ia
ler
,
err
:=
util
.
GetAddressAndDialer
(
"unix://"
+
cfg
.
Containerd
.
Address
)
if
err
!=
nil
{
time
.
Sleep
(
1
*
time
.
Second
)
continue
}
conn
,
err
:=
grpc
.
Dial
(
addr
,
grpc
.
WithInsecure
(),
grpc
.
WithTimeout
(
3
*
time
.
Second
),
grpc
.
WithDialer
(
d
ai
ler
),
grpc
.
WithDefaultCallOptions
(
grpc
.
MaxCallRecvMsgSize
(
maxMsgSize
)))
conn
,
err
:=
grpc
.
Dial
(
addr
,
grpc
.
WithInsecure
(),
grpc
.
WithTimeout
(
3
*
time
.
Second
),
grpc
.
WithDialer
(
d
ia
ler
),
grpc
.
WithDefaultCallOptions
(
grpc
.
MaxCallRecvMsgSize
(
maxMsgSize
)))
if
err
!=
nil
{
time
.
Sleep
(
1
*
time
.
Second
)
continue
...
...
pkg/agent/netpol/network_policy_controller.go
View file @
7cc01100
...
...
@@ -49,11 +49,11 @@ const (
// filter table a rule is added to jump the traffic originating (in case of egress network policy) from the pod
// or destined (in case of ingress network policy) to the pod specific iptables chain. Each
// pod specific iptables chain has rules to jump to the network polices chains, that pod matches. So packet
// originating/destined from/to pod goes through fi
tl
er table's, FORWARD chain, followed by pod specific chain,
// originating/destined from/to pod goes through fi
lt
er table's, FORWARD chain, followed by pod specific chain,
// followed by one or more network policy chains, till there is a match which will accept the packet, or gets
// dropped by the rule in the pod chain, if there is no match.
// NetworkPolicyController str
cu
t to hold information required by NetworkPolicyController
// NetworkPolicyController str
uc
t to hold information required by NetworkPolicyController
type
NetworkPolicyController
struct
{
nodeIP
net
.
IP
nodeHostName
string
...
...
@@ -138,7 +138,7 @@ type numericPort2eps map[string]*endPoints
type
protocol2eps
map
[
string
]
numericPort2eps
type
namedPort2eps
map
[
string
]
protocol2eps
// Run runs forver till we receive notification on stopCh
// Run runs for
e
ver till we receive notification on stopCh
func
(
npc
*
NetworkPolicyController
)
Run
(
stopCh
<-
chan
struct
{})
{
t
:=
time
.
NewTicker
(
npc
.
syncPeriod
)
defer
t
.
Stop
()
...
...
@@ -320,16 +320,16 @@ func (npc *NetworkPolicyController) syncNetworkPolicyChains(version string) (map
activePolicyIPSets
[
targetDestPodIPSet
.
Name
]
=
true
activePolicyIPSets
[
targetSourcePodIPSet
.
Name
]
=
true
curr
ne
tPodIPs
:=
make
([]
string
,
0
,
len
(
policy
.
targetPods
))
curr
en
tPodIPs
:=
make
([]
string
,
0
,
len
(
policy
.
targetPods
))
for
ip
:=
range
policy
.
targetPods
{
curr
netPodIPs
=
append
(
currne
tPodIPs
,
ip
)
curr
entPodIPs
=
append
(
curren
tPodIPs
,
ip
)
}
err
=
targetSourcePodIPSet
.
Refresh
(
curr
ne
tPodIPs
,
OptionTimeout
,
"0"
)
err
=
targetSourcePodIPSet
.
Refresh
(
curr
en
tPodIPs
,
OptionTimeout
,
"0"
)
if
err
!=
nil
{
log
.
Errorf
(
"failed to refresh targetSourcePodIPSet: "
+
err
.
Error
())
}
err
=
targetDestPodIPSet
.
Refresh
(
curr
ne
tPodIPs
,
OptionTimeout
,
"0"
)
err
=
targetDestPodIPSet
.
Refresh
(
curr
en
tPodIPs
,
OptionTimeout
,
"0"
)
if
err
!=
nil
{
log
.
Errorf
(
"failed to refresh targetDestPodIPSet: "
+
err
.
Error
())
}
...
...
@@ -463,7 +463,7 @@ func (npc *NetworkPolicyController) processIngressRules(policy networkPolicyInfo
}
}
// case where nether ports nor from details are speified in the ingress rule
// case where nether ports nor from details are spe
c
ified in the ingress rule
// so match on all ports, protocol, source IP's
if
ingressRule
.
matchAllSource
&&
ingressRule
.
matchAllPorts
{
comment
:=
"rule to ACCEPT traffic from all sources to dest pods selected by policy name: "
+
...
...
@@ -621,7 +621,7 @@ func (npc *NetworkPolicyController) processEgressRules(policy networkPolicyInfo,
}
}
// case where nether ports nor from details are speified in the egress rule
// case where nether ports nor from details are spe
c
ified in the egress rule
// so match on all ports, protocol, source IP's
if
egressRule
.
matchAllDestinations
&&
egressRule
.
matchAllPorts
{
comment
:=
"rule to ACCEPT traffic from source pods to all destinations selected by policy name: "
+
...
...
@@ -808,7 +808,7 @@ func (npc *NetworkPolicyController) syncPodFirewallChains(version string) (map[s
return
nil
,
fmt
.
Errorf
(
"Failed to run iptables command: %s"
,
err
.
Error
())
}
// ensure stateful
l
firewall, that permits return traffic for the traffic originated by the pod
// ensure stateful firewall, that permits return traffic for the traffic originated by the pod
comment
=
"rule for stateful firewall for pod"
args
=
[]
string
{
"-m"
,
"comment"
,
"--comment"
,
comment
,
"-m"
,
"conntrack"
,
"--ctstate"
,
"RELATED,ESTABLISHED"
,
"-j"
,
"ACCEPT"
}
exists
,
err
=
iptablesCmdHandler
.
Exists
(
"filter"
,
podFwChainName
,
args
...
)
...
...
@@ -906,7 +906,7 @@ func (npc *NetworkPolicyController) syncPodFirewallChains(version string) (map[s
return
nil
,
fmt
.
Errorf
(
"Failed to run iptables command: %s"
,
err
.
Error
())
}
// ensure stateful
l
firewall, that permits return traffic for the traffic originated by the pod
// ensure stateful firewall, that permits return traffic for the traffic originated by the pod
comment
=
"rule for stateful firewall for pod"
args
=
[]
string
{
"-m"
,
"comment"
,
"--comment"
,
comment
,
"-m"
,
"conntrack"
,
"--ctstate"
,
"RELATED,ESTABLISHED"
,
"-j"
,
"ACCEPT"
}
exists
,
err
=
iptablesCmdHandler
.
Exists
(
"filter"
,
podFwChainName
,
args
...
)
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment